@techreport{ietf-dnsop-ns-revalidation-06, number = {draft-ietf-dnsop-ns-revalidation-06}, type = {Internet-Draft}, institution = {Internet Engineering Task Force}, publisher = {Internet Engineering Task Force}, note = {Work in Progress}, url = {https://datatracker.ietf.org/doc/draft-ietf-dnsop-ns-revalidation/06/}, author = {Shumon Huque and Paul A. Vixie and Willem Toorop}, title = {{Delegation Revalidation by DNS Resolvers}}, pagetotal = 10, year = 2024, month = mar, day = 17, abstract = {This document recommends improved DNS {[}RFC1034{]} {[}RFC1035{]} resolver behavior with respect to the processing of Name Server (NS) resource record sets (RRset) during iterative resolution. When following a referral response from an authoritative server to a child zone, DNS resolvers should explicitly query the authoritative NS RRset at the apex of the child zone and cache this in preference to the NS RRset on the parent side of the zone cut. The (A and AAAA) address RRsets in the additional section from referral responses and authoritative NS answers for the names of the NS RRset, should similarly be re- queried and used to replace the entries with the lower trustworthiness ranking in cache. Resolvers should also periodically revalidate the child delegation by re-querying the parent zone at the expiration of the TTL of the parent side NS RRset.}, }